CVE-2009-1709

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-10 · updated 2026-06-16
Weakness: CWE-399

Description

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."

Affected products

Apple Safari: through 4.0_beta; through 3.2.3; 0.8, 0.9, 1.0, 1.0.3, 1.1, 1.2 (+18)

References

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://osvdb.org/55013
http://secunia.com/advisories/35379
http://secunia.com/advisories/35576
http://secunia.com/advisories/36461
http://secunia.com/advisories/43068
http://securitytracker.com/id?1022345
http://support.apple.com/kb/HT3613
http://www.mandriva.com/security/advisories?name=MDVSA-2010:182
http://www.redhat.com/support/errata/RHSA-2009-1130.html
http://www.securityfocus.com/bid/35260

Get alerted when CVE-2009-1709 or the next vulnerability affects your stack